@wtfalch/foundry 0.6.0 → 0.7.1

package/dist/migrations/0027_audit_chain.sql

@@ -0,0 +1,170 @@
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: hash chaining, opt in.
+--
+-- Mirrors src/chain.ts and src/tables.ts. Every statement is idempotent.
+-- Applied by the host's own migrate script after the host copies this file
+-- into its drizzle/ directory as the next number (audit-migrations); never
+-- edited there.
+--
+-- Nothing here forces chaining. Five nullable columns, computed and
+-- verified entirely in TypeScript (src/chain.ts), the same design
+-- `@wtfalch/authz`'s audit-chain.ts already shipped: no pgcrypto, no
+-- trigger, because PGlite -- this package's own default test database --
+-- has no pgcrypto, and a trigger cannot see the previous row's hash without
+-- a race between concurrent inserts that only a lock (below) closes.
+--
+--   prev_hash     -- the previous row's row_hash, in whatever order rows
+--                     were sealed at write time. null for the chain's first
+--                     row, and forever on a row nothing ever sealed.
+--   row_hash      -- sha256 over this row's own fields (chain.ts's
+--                     ROW_HASH_KEYS) plus prev_hash and content_hash. Never
+--                     changes once set; the append-only guard below still
+--                     refuses to.
+--   content_hash  -- sha256 over the row's erasable content (actor_display,
+--                     target_display, before, after), salted.
+--   content_salt  -- the salt content_hash was taken over. Set at seal
+--                     time, nulled by erasure: once it is gone nobody --
+--                     including this package -- can reproduce content_hash
+--                     from a guessed payload, which is what erasure means
+--                     here. Unlike row_hash, an erasure IS allowed to null
+--                     this, so the guard's allowed list grows to include it.
+--   erasure_hash  -- set only once content_salt is nulled: sha256 over
+--                     { row_hash, erased_at }, so the fact and the instant
+--                     of erasure stay checkable forever even though the
+--                     erased content no longer is.
+--
+-- A row written before this migration applies has row_hash null forever --
+-- nothing recorded its hash at write time, so computing one now would only
+-- hash what the row happens to contain today, proving nothing about
+-- whether it changed since. verifyChain reports it 'unsealed', not
+-- verified, the same stance 0002's target_display took on the rows before
+-- it and worker_log_chain took on the rows before T255.
+--
+-- audit_seal_erasure(row_id, erasure_hash_value): the runtime role has no
+-- UPDATE on audit_events at all (0001's revoke), so ledger.erase()'s
+-- pending-erasure sweep -- setting content_salt to null and erasure_hash
+-- once a chain-sealed row has been erased -- needs its own security
+-- definer door back in, the same shape as audit_erase_person's.
+
+alter table audit_events add column if not exists prev_hash text;
+alter table audit_events add column if not exists row_hash text;
+alter table audit_events add column if not exists content_hash text;
+alter table audit_events add column if not exists content_salt text;
+alter table audit_events add column if not exists erasure_hash text;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_prev_hash_check
+    check (prev_hash is null or prev_hash ~ '^[0-9a-f]{64}$');
+exception when duplicate_object then null; end $$;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_row_hash_check
+    check (row_hash is null or row_hash ~ '^[0-9a-f]{64}$');
+exception when duplicate_object then null; end $$;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_content_hash_check
+    check (content_hash is null or content_hash ~ '^[0-9a-f]{64}$');
+exception when duplicate_object then null; end $$;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_erasure_hash_check
+    check (erasure_hash is null or erasure_hash ~ '^[0-9a-f]{64}$');
+exception when duplicate_object then null; end $$;
+
+-- A chain-sealed row not yet erased, so ledger.erase()'s pending-erasure
+-- sweep finds it in an index scan rather than a table scan. Empty on a
+-- host that never turns chaining on.
+create index if not exists audit_events_chain_pending_idx
+  on audit_events (id)
+  where row_hash is not null and erased_at is not null and erasure_hash is null;
+
+-- 0002's guard, with content_salt and erasure_hash added to the columns an
+-- update may change: erasure nulls the first and sets the second, on a row
+-- that was already erased by the same audit_erase_person call this
+-- migration does not touch. prev_hash, row_hash and content_hash are
+-- absent from the list on purpose -- once set, never.
+create or replace function audit_events_guard() returns trigger
+language plpgsql as $$
+begin
+  if tg_op = 'DELETE' then
+    raise exception 'audit_events is append-only: delete refused';
+  elsif tg_op = 'TRUNCATE' then
+    raise exception 'audit_events is append-only: truncate refused';
+  elsif tg_op = 'UPDATE' then
+    if new.id is distinct from old.id
+      or new.occurred_at is distinct from old.occurred_at
+      or new.tenant_id is distinct from old.tenant_id
+      or new.tenant_display is distinct from old.tenant_display
+      or new.actor_class is distinct from old.actor_class
+      or new.actor_id is distinct from old.actor_id
+      or new.action is distinct from old.action
+      or new.target_type is distinct from old.target_type
+      or new.target_id is distinct from old.target_id
+      or new.outcome is distinct from old.outcome
+      or new.context is distinct from old.context
+      or new.session_id is distinct from old.session_id
+      or new.reason is distinct from old.reason
+      or new.reference is distinct from old.reference
+      or new.request_id is distinct from old.request_id
+      or new.ip is distinct from old.ip
+      or new.user_agent is distinct from old.user_agent
+      or new.tenant_visible is distinct from old.tenant_visible
+      or new.schema_version is distinct from old.schema_version
+      or new.subject_class is distinct from old.subject_class
+      or new.subject_id is distinct from old.subject_id
+      or new.prev_hash is distinct from old.prev_hash
+      or new.row_hash is distinct from old.row_hash
+      or new.content_hash is distinct from old.content_hash
+    then
+      raise exception 'audit_events is append-only: only actor_display, target_display, before, after, erased_at, content_salt and erasure_hash may change';
+    end if;
+  end if;
+  return new;
+end
+$$;
+
+-- 0001's revoke took update off the runtime role entirely, on purpose:
+-- audit_erase_person (security definer) is the one door back in. This is
+-- the second one, for exactly one thing: chain-sealing a row
+-- audit_erase_person already erased. It never computes a hash itself --
+-- the caller does, in TypeScript (chain.ts's computeErasureHash), the same
+-- design choice audit_erase_person's own absence of a hash column made
+-- before this file existed -- it only writes the value it is given, and
+-- only onto a row that is erased, chain-sealed, and not already sealed.
+create or replace function audit_seal_erasure(row_id bigint, erasure_hash_value text)
+returns void
+language plpgsql
+security definer
+set search_path = pg_catalog, public
+as $$
+begin
+  update audit_events
+     set content_salt = null,
+         erasure_hash = erasure_hash_value
+   where id = row_id
+     and row_hash is not null
+     and erased_at is not null
+     and erasure_hash is null;
+end
+$$;
+revoke all on function audit_seal_erasure(bigint, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('grant execute on function audit_seal_erasure(bigint, text) to %I', rt);
+  end if;
+end
+$$;

package/dist/migrations/0028_audit_rls.sql

@@ -0,0 +1,111 @@
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: row-level security on audit_events.
+--
+-- Mirrors src/ledger.ts (scopeAuditTenant). Every statement is idempotent.
+-- Applied by the host's own migrate script after the host copies this file
+-- into its drizzle/ directory as the next number (audit-migrations); never
+-- edited there.
+--
+-- Until this file, tenant isolation was only the `tenantId` a caller
+-- remembered to pass to ledger.page(). One missed predicate showed a
+-- customer another company's trail. With RLS on, the database holds the
+-- line for every role that is not the table's owner -- the runtime role
+-- <database>_rt, and any read-only role a host adds:
+--
+--   audit.tenant_id       -- set per transaction by the host
+--                            (scopeAuditTenant, or
+--                            set_config('audit.tenant_id', $1, true)).
+--                            While set, a SELECT sees that tenant's rows and
+--                            nothing else -- not another tenant's, and not
+--                            the estate's own tenant_id-null rows.
+--   audit.require_tenant  -- 'on' makes an unscoped SELECT see nothing
+--                            instead of everything. Set it on a role, once:
+--                              alter role <database>_rt set audit.require_tenant = 'on';
+--                            That is the setting that survives a forgotten
+--                            scope. It is not set here because an operator
+--                            surface reads across tenants on purpose, and
+--                            which role does that is the host's decision.
+--
+-- Unset and not required, a SELECT sees every row, exactly as before this
+-- file: applying it changes nothing for a host until the host scopes.
+--
+-- INSERT is not restricted: a request scoped to one tenant may still record
+-- an estate-level (tenant_id null) event, and the ledger's own vocabulary
+-- checks already decide what may be written. UPDATE and DELETE have no
+-- policy, so they stay refused for the runtime role -- which 0001's revoke
+-- already did.
+--
+-- Not FORCE: the owner, and the security definer functions it owns
+-- (audit_erase_person, audit_seal_erasure, and the two below), bypass RLS.
+-- Erasure is by subject, across tenants, by design.
+
+alter table audit_events enable row level security;
+
+drop policy if exists audit_events_read on audit_events;
+create policy audit_events_read on audit_events
+  for select
+  using (
+    case
+      when coalesce(current_setting('audit.tenant_id', true), '') <> ''
+        then tenant_id is not null
+         and tenant_id = current_setting('audit.tenant_id', true)::uuid
+      when coalesce(current_setting('audit.require_tenant', true), '') = 'on'
+        then false
+      else true
+    end
+  );
+
+drop policy if exists audit_events_append on audit_events;
+create policy audit_events_append on audit_events
+  for insert
+  with check (true);
+
+-- The hash chain is one chain across every tenant. Under a tenant scope the
+-- runtime role can no longer see the true tail, so ledger.sign() with
+-- hashChain on would chain onto that tenant's last row and fork the chain.
+-- This reads the tail as the owner. It returns a hash, never content.
+create or replace function audit_chain_tail()
+returns text
+language sql
+stable
+security definer
+set search_path = pg_catalog, public
+as $$
+  select row_hash from audit_events order by id desc limit 1
+$$;
+revoke all on function audit_chain_tail() from public;
+
+-- The same for ledger.erase()'s pending-erasure sweep, which must find
+-- every tenant's pending rows, scoped or not. Ids, hashes and erasure
+-- instants only.
+create or replace function audit_pending_erasures()
+returns table (id bigint, row_hash text, erased_at timestamptz)
+language sql
+stable
+security definer
+set search_path = pg_catalog, public
+as $$
+  select e.id, e.row_hash, e.erased_at
+    from audit_events e
+   where e.row_hash is not null
+     and e.erased_at is not null
+     and e.erasure_hash is null
+   order by e.id
+$$;
+revoke all on function audit_pending_erasures() from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('grant execute on function audit_chain_tail() to %I', rt);
+    execute format('grant execute on function audit_pending_erasures() to %I', rt);
+  end if;
+end
+$$;

package/dist/org.d.ts

@@ -99,6 +99,12 @@ export declare const DEFAULT_NO_REPLY_LOCAL_PART = "no-reply";
  * Never fired by `domain` alone (#7 amendment 1).
  */
 export interface ChatConfig {
+    /**
+     * Chat is not in v1 (decided 2026-10-01): off by default for every org.
+     * While off, `apply` plans no chat step and leaves a live chat resource
+     * alone, listed in `unmanaged`; Agora hides all chat and call UI.
+     */
+    enabled: boolean;
     usesDomain: boolean;
 }
 /**
@@ -214,7 +220,25 @@ export interface HostingConfig {
      * means no Access gate. Requires `enabled`.
      */
     accessEmails: string[];
+    /**
+     * Maps the app's own env var name to one of `AppEnvSource`'s values --
+     * each a value the plan already mints for this org (Files, AI, mail) but
+     * never used to push an app's own env (#243). Each bespoke app names these
+     * differently (lokessmie uses `STORAGE_*`/`AI_*`); this is how an org
+     * declares its own app's names for them. `{}` means the app names none of
+     * them, so `pushAppEnv` pushes nothing from this map.
+     */
+    appEnv: Record<string, AppEnvSource>;
 }
+/**
+ * The closed set of values the plan already mints that `HostingConfig.appEnv`
+ * may map an app's env var name to (#243): the org's own Files organisation
+ * id, its AI organisation id, and the mail domain its Lettermint project
+ * sends from. Each is read from `StepExecutionContext.recordedIds()` in
+ * `executor.ts`'s `pushAppEnv`, never minted again there.
+ */
+export type AppEnvSource = 'filesOrganisationId' | 'aiOrganisationId' | 'mailDomain';
+export declare const APP_ENV_SOURCES: ReadonlySet<AppEnvSource>;
 /**
  * `null` when `hosting` is valid; otherwise the reason it is not (#71), same
  * shape as `validateBuyerIdentity` below.

package/dist/org.js

@@ -2,6 +2,11 @@
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
 export const DEFAULT_NO_REPLY_LOCAL_PART = 'no-reply';
+export const APP_ENV_SOURCES = new Set([
+    'filesOrganisationId',
+    'aiOrganisationId',
+    'mailDomain',
+]);
 const ISSUER_APP_KINDS = new Set(['web', 'native', 'api']);
 const HOSTING_BUILD_PACKS = new Set([
     'dockerfile',
@@ -62,6 +67,14 @@ export function validateHosting(hosting) {
             return `issuerApps '${app.name}' is reserved for the always-on Agora client every org gets`;
         }
     }
+    for (const [envName, source] of Object.entries(hosting.appEnv)) {
+        if (!envName) {
+            return 'every appEnv key needs a non-empty env var name';
+        }
+        if (!APP_ENV_SOURCES.has(source)) {
+            return `appEnv '${envName}' has an unknown source '${source}'`;
+        }
+    }
     return null;
 }
 /**

package/dist/plan/agora.d.ts

@@ -13,6 +13,27 @@ import type { DeclaredOrg, OrgId } from '../org.js';
  */
 export declare const ZITADEL_ORG_SCOPE_KEY = "zitadel_org";
 export declare const AGORA_CLIENT_ID_SCOPE_KEY = "agora_client_id";
+/**
+ * The recorded OIDC app's `clientId` (level-1 app-env campaign, gap P2) —
+ * not a `system:kind:key` resource id (that slot already holds the app's
+ * `appId`, `zitadelApp`'s own `resourceId`) and not a secret (`deliverSecret`
+ * is for that), so a flat scope id like `zitadel_org`/`zitadel_project`
+ * above. A level-1 org declares exactly one web `issuerApps` entry for its
+ * one standard app, so one flat key is enough; an org with more than one web
+ * app would need a richer key, not built here (Finding, this campaign's
+ * report).
+ */
+export declare const APP_CLIENT_ID_SCOPE_KEY = "zitadel_app_client_id";
+/**
+ * #139: the `cms` app's own ZITADEL web client's `clientId`, recorded
+ * separately from {@link APP_CLIENT_ID_SCOPE_KEY} -- that key belongs to the
+ * org's own hosted app (`diff.ts`'s `planIssuerApps`), a different
+ * `zitadel:app` step from the fixed `cms` client `diff.ts`'s `planCmsClient`
+ * plans. `cmsSite` reads this key to push `AUTH_CLIENT_ID` onto the cms app,
+ * the same way `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` for the hosted
+ * app.
+ */
+export declare const CMS_CLIENT_ID_SCOPE_KEY = "cms_client_id";
 /**
  * The accent every org's Agora wears until orgs choose their own: the house
  * theme's `--accent` (`@wtfalch/house`, `HOUSE_THEMES['good-company']` in

package/dist/plan/agora.js

@@ -12,6 +12,27 @@
  */
 export const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
 export const AGORA_CLIENT_ID_SCOPE_KEY = 'agora_client_id';
+/**
+ * The recorded OIDC app's `clientId` (level-1 app-env campaign, gap P2) —
+ * not a `system:kind:key` resource id (that slot already holds the app's
+ * `appId`, `zitadelApp`'s own `resourceId`) and not a secret (`deliverSecret`
+ * is for that), so a flat scope id like `zitadel_org`/`zitadel_project`
+ * above. A level-1 org declares exactly one web `issuerApps` entry for its
+ * one standard app, so one flat key is enough; an org with more than one web
+ * app would need a richer key, not built here (Finding, this campaign's
+ * report).
+ */
+export const APP_CLIENT_ID_SCOPE_KEY = 'zitadel_app_client_id';
+/**
+ * #139: the `cms` app's own ZITADEL web client's `clientId`, recorded
+ * separately from {@link APP_CLIENT_ID_SCOPE_KEY} -- that key belongs to the
+ * org's own hosted app (`diff.ts`'s `planIssuerApps`), a different
+ * `zitadel:app` step from the fixed `cms` client `diff.ts`'s `planCmsClient`
+ * plans. `cmsSite` reads this key to push `AUTH_CLIENT_ID` onto the cms app,
+ * the same way `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` for the hosted
+ * app.
+ */
+export const CMS_CLIENT_ID_SCOPE_KEY = 'cms_client_id';
 /**
  * The accent every org's Agora wears until orgs choose their own: the house
  * theme's `--accent` (`@wtfalch/house`, `HOUSE_THEMES['good-company']` in
@@ -85,6 +106,8 @@ export function desiredAgoraEnv(org, recorded, host) {
             organisationId: zitadelOrgId,
             mailProjectId: host.mailProjectId,
             messagingProjectId: host.messagingProjectId,
+            // Chat is not in v1: Agora hides all chat UI unless this is true.
+            chat: { enabled: org.chat.enabled },
         });
     }
     if (org.mail.mode !== 'off' && host.mailUpstream) {

package/dist/plan/calls-matrix.d.ts

@@ -45,8 +45,8 @@
  * (`executor.ts`'s `callsHostnameFor`).
  */
 export declare const SYNAPSE_IMAGE = "ghcr.io/element-hq/synapse";
-export declare const SYNAPSE_TAG = "v1.161.0";
-export declare const MAS_IMAGE = "ghcr.io/element-hq/matrix-authentication-service:1.24.0";
+export declare const SYNAPSE_TAG: string;
+export declare const MAS_IMAGE: string;
 /**
  * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
  * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and

package/dist/plan/calls-matrix.js

@@ -1,4 +1,5 @@
 import { generateKeyPairSync, randomBytes } from 'node:crypto';
+import { VERSIONS } from '../bootstrap/versions.js';
 /**
  * The calls Matrix stack (#128, part 1 of 2 -- see that issue's "If this
  * passes about 800 changed lines, split it" note): pure config generation
@@ -46,8 +47,8 @@ import { generateKeyPairSync, randomBytes } from 'node:crypto';
  * (`executor.ts`'s `callsHostnameFor`).
  */
 export const SYNAPSE_IMAGE = 'ghcr.io/element-hq/synapse';
-export const SYNAPSE_TAG = 'v1.161.0';
-export const MAS_IMAGE = 'ghcr.io/element-hq/matrix-authentication-service:1.24.0';
+export const SYNAPSE_TAG = VERSIONS.synapse;
+export const MAS_IMAGE = `ghcr.io/element-hq/matrix-authentication-service:${VERSIONS.mas}`;
 /**
  * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
  * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and

package/dist/plan/cloudflared-connector.d.ts

@@ -2,9 +2,10 @@ import type { CloudflarePort, CoolifyPort } from './executor.js';
 /**
  * #197: the pinned `cloudflared` image, the same release tag as
  * `scripts/shared-ingress.mjs`'s and `calls-sfu.ts`'s own
- * `CLOUDFLARED_IMAGE_REF`. A test in each keeps the three equal.
+ * `CLOUDFLARED_IMAGE_REF`. A test in each keeps the three equal. Pinned in
+ * `versions.json` (#247).
  */
-export declare const CLOUDFLARED_IMAGE_REF = "cloudflare/cloudflared:2026.9.3";
+export declare const CLOUDFLARED_IMAGE_REF: string;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published

package/dist/plan/cloudflared-connector.js

@@ -1,10 +1,12 @@
+import { VERSIONS } from '../bootstrap/versions.js';
 import { isNotFoundError } from './executor.js';
 /**
  * #197: the pinned `cloudflared` image, the same release tag as
  * `scripts/shared-ingress.mjs`'s and `calls-sfu.ts`'s own
- * `CLOUDFLARED_IMAGE_REF`. A test in each keeps the three equal.
+ * `CLOUDFLARED_IMAGE_REF`. A test in each keeps the three equal. Pinned in
+ * `versions.json` (#247).
  */
-export const CLOUDFLARED_IMAGE_REF = 'cloudflare/cloudflared:2026.9.3';
+export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudflared}`;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published
@@ -72,7 +74,7 @@ export async function ensureCloudflaredConnector(input) {
             environment_uuid: input.environment.uuid,
             dockerfile: cloudflaredDockerfile(),
             name: input.appName,
-            description: 'cloudflared connector for this platform tunnel (#197)',
+            description: 'cloudflared connector for a Cloudflare tunnel',
             instant_deploy: false,
         });
         appId = created.uuid;

package/dist/plan/diff.d.ts

@@ -26,6 +26,15 @@ export interface PlannedStep {
     step: PlanStep;
     action: StepAction;
 }
+/**
+ * Facts about the host's executor ports that an org's plan needs, so a step
+ * whose port is not wired is reported blocked instead of planned (rule 2).
+ * New ones go here, not in new positional arguments (rule 7).
+ */
+export interface PlanOrgOptions {
+    /** #267: the executor was built with a `loginHostBindings` port. */
+    loginHostBindings?: boolean;
+}
 export interface PlanDetail {
     orgId: OrgId;
     plannedSteps: PlannedStep[];
@@ -73,7 +82,11 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * app with the platform's jobs scheduler, idempotent on the *recorded*
  * resource id like {@link planOwner} rather than a live resource, since
  * nothing in `live` can report a scheduler registration (no reader exists for
- * it). Everything
+ * it). #267 adds one more, right after {@link planOwner} and before every
+ * app-creating step below: {@link planLoginHost}, the org's own company
+ * login host -- also idempotent on the *recorded* resource id, since
+ * `live` has no notion of a ZITADEL trusted domain or a login binding
+ * either. Everything
  * else in `live` that none of these eighteen singletons and however many
  * declared issuer apps claim is unmanaged. The full field-by-field provisioning surface (SSO,
  * guests, calls on the org's own domain, adopted/bespoke apps, the actual
@@ -81,7 +94,7 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * Company Factory end to end", which wires real readers and executors
  * against this seam.
  */
-export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[], recordedIds?: Readonly<Record<string, string>>, agoraHost?: AgoraHostReading, jobsAvailable?: boolean, platformReadiness?: OrgPlatformReadiness): PlanDetail;
+export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[], recordedIds?: Readonly<Record<string, string>>, agoraHost?: AgoraHostReading, jobsAvailable?: boolean, platformReadiness?: OrgPlatformReadiness, options?: PlanOrgOptions): PlanDetail;
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */